I’m a writer in New York. I’ve written for The New Yorker, The Atlantic, The New Republic, Slate, The Daily Beast, The New Inquiry, n+1, Complex, Bookforum, Edge, Billboard, Men’s Health, The Believer, LA Review of Books and many others. I’m also author of the sex memoir Levitate the Primate: Handjobs, Internet Dating, and Other Issues for Men, which The Millions called “a Symposium for heteros,” and The Atlantic selected as one of its “Best Beach Reads for Smart People.”

Valve's Social Engineering Campaign Against Cheaters is Out of Bounds

The conflict between cheaters and fair-play advocates is an old one in game culture, mostly left to individual discretion in earlier days. Now that competitive online play has become a bigger part of the game industry, with League of Legends, StarCraft 2, DotA 2, and the hat-happy Team Fortress 2, the conflict is intensifying. Case in point: last month a number of posters on Reddit accused Valve of using its anti-cheat software—VAC—to spy on users, alleging it a person’s browser history and sends that information back to Valve for review. Company co-founder Gabe Newell took the unusual step of making his own Reddit post to rebuff critics and explain exactly what VAC is doing on its users computers. “Do we care what porn sites you visit?” Newell asked. “Oh dear god, no. My brain just melted.”

Newell assured users their privacy would remain in tact while detailing exactly what kind of user information does go through VAC. As Newell described it, VAC searches for the presence of cheat codes on a computer, and if found it begins scanning that computer’s DNS cache to see if it’s actually connected to a cheat code server for activation. If the software finds a partial match in the DNS cache, it sends the information back to Valve to be cross-checked against a list on their servers, and if a match is found the user is marked for ban.

Newell claims fewer than a tenth of one percent of users have triggered a second check-through to Valve’s servers, and of Steam’s more than 65 million users, only 570 have so far been banned as a result. “Our response is to make it clear what we were actually doing and why with enough transparency that people can make their own judgements as to whether or not we are trustworthy,” Newell wrote. He acknowledged it’s up to users to “make the call if we are trustworthy. We try really hard to earn and keep your trust.”

The company, in other words, has built software capable of doing what many fear–accessing private information about which domains a computer contacts–but promises to use that capability in an extremely narrow and limited capacity. Newell described the spying accusation as “social engineering,” part of an effort to erode Valve’s trustworthiness as a company. In response, Valve is engaging in its own implicit campaign of social engineering by assuming certain forms of play and experimentation should be illicit, justification for mandatory software that logs user data while weakening hardline respect for user privacy and a support for players to use software they’ve purchased in whatever way they wish.

A group of Brazilian computer hackers at work. Photo via Rodrigo Paoletti/Creative Commons

It’s disturbing that Valve’s anti-cheat technology seems designed to protect the company’s majority consumer base at the expense of a smaller group who approach play from a different but no less valid position. Instead of encouraging a culture where these rule-followers and rule-breakers can engage one another in creative and confrontational ways, each pushing back against the other to stretch the boundaries of what is possible in a game, Valve has instead chosen to side with the most profitable faction and participate in dispute with its own kind of “social engineering.”

Cheaters are the lifeblood of game culture, a constant reminder that play is not a competition between people who have internalized artificial rules, but a negotiation about the rules themselves. What new social forms emerge when rule-follower and rule-breaker are forced to accommodate, one another? What happens in a competitive first person shooter when everyone is invincible? Or if one person is invincible and everyone else had to decide whether or not to carry on competing with the occasional possibility of being unfairly killed, or else team up to try and identify, harass, disrupt, or worship the god mode hacker. Just as there are countless variations for creatively following rules, there is countless new forms of interaction, experimentation, and play that could come from destroying the artificial constraints of game rules, allowing cheaters to freely mingle with the rule-bound.

Valve’s anti-cheat software is less a tool to preserve the purity of play than an enforcer that ensures play must always occur under the same formulaic constraints and anyone wanting to experiment from the outside-in will be delegitimized, stripped of their rights as a consumer and participant in the community. Newell claims to be uninterested in the sorts of porn sites Steam’s users visit, but then invokes an implicit probity about those who desire unsanctioned pleasures of playing in a supposedly taboo way. Valve’s counter-social engineering makes outlaws of cheaters and the people who code tools for them, while justifying an omni-present surveillance tool that, for the time being, it promises is only interested in scanning for known cheat codes and the servers they attach to.

Valve is famed for its commitment to openness and pursuit of platforms that allow users maximum flexibility. In practice that belief is turning out to be more a freedom to pay for access to controlled, inflexible set of game experiences that Valve profits from policing, defining for everyone what legitimate play should be rather than letting players negotiate it for themselves through games themselves. Freedom depends on the frame surrounding it, and the spirit of play demands the possibility of constantly reframing experiences in response to what someone else claims cannot or should not be done. Valve’s anti-cheat policies are already an incursion into the private choices that many of its customers are making on their own, and it doesn’t need to scan for porn in their browser histories to count as a violation.

Post Your Comment

Post Your Reply

Forbes writers have the ability to call out member comments they find particularly interesting. Called-out comments are highlighted across the Forbes network. You'll be notified if your comment is called out.

Comments

Um, the supposed “benefits” of cheaters you’re talking about is what the modding community does. Cheaters should be banned for ruining the game for everyone else due to their own selfish desires. Modding should be and is encouraged for all the reasons you post above.

That said, Valve’s software does sound intrusive. I’m reluctant to trust anyone who says “Trust us, we’ll never take it too far”. I find that is usually a promise not kept. It is only a matter of “when” not “if”. If Valve’s software can see your porn history (from the article it sounds like they could), what happens if they see illegal kiddie porn on there? Does Valve report it to the authorities? Or in the interest of privacy do they not report it? Then, after they report it once (they will eventually, don’t kid yourself), what else do they start searching for? It’s a slippery slope and in my experience, it is usually only a matter of time before someone starts sliding.

Granted, all this is moot if Valve’s software cannot see your browser history, I’m murky on that.

If they can’t see your browser history now, they probably will soon. Cheat prevention is a never-ending arms race. Valve needs to look carefully at how they proceed from here; Do they test all the good will they’ve gained over the years by adding more intrusive anti-cheat measures to people’s computers or do they expand on what they do within their own boundaries (games and the Steam client) to catch cheaters?

Just imagine standing up in court and trying to use this ‘breaking the rules is a good thing’ as your defence. I’m sure the judge would be so impressed he’d reward you, by handing out the maximum possible sentence for your crime.

In online game the rules are there to level the playing field between players. Cheaters should not be tolerated, they wreck the experience for others and hurt the game by putting them off playing further. If you were talking about single player game fair enough, but not online games.

This guy is living in a fantasy world. He is completely ignoring the blatant fact that there are VAC servers and non-VAC servers. People make a conscious and deliberate decision to play on VAC secure servers for a reason – they don’t want to be bothered by cheaters or those that will augment the original game experience in a malicious way. If it’s not malicious then they would bring out their invention as a mod, another game, a custom server or something else but definitely NEVER as a hack on a VAC secure server. And if is likely to trigger VAC then they would warn users to stay off VAC secure servers. Do your research first rather than writing an emotional plea based on your own contrivances.

https://support.steampowered.com/kb_article.php?p_faqid=370

“Valve Anti-Cheat System (VAC) What is VAC? If a user connects to a VAC-Secured server from a computer with identifiable cheats installed, the VAC system will ban the user from playing on VAC-Secured servers in the future. … Any third-party modification to a game designed to give one player an advantage over another is classified as a cheat or hack and will trigger a VAC ban. This includes modifications to a game’s CORE EXECUTABLE FILES AND DYNAMIC LINK LIBRARIES. … Use only trusted machines to play on VAC-Secured servers – if you are not sure whether or not the machine you are using to connect to Steam may have cheats installed, do not play on VAC-Secured servers.”

“Cheaters are the lifeblood of game culture, a constant reminder that play is not a competition between people who have internalized artificial rules, but a negotiation about the rules themselves”

Cheaters have been ruining competitive online games since competitive online games have existed. They certainly are NOT the lifeblood of game culture. You are confusing modders with cheaters! Cheaters are free to cheat on non-VAC secured servers. Most of the modded servers I join also have VAC protection enabled.

If I’m to believe what Valve says about how their anti-cheat software works (only sending matching DNS entries to their VAC servers) then I’m sort-of ok with such a compromise. I have never used, accessed or installed cheats so VAC should never get to the stage of checking my DNS cache because it would first have to find the presence of cheats on my workstation.

“Trust is a critical part of a multiplayer game community – trust in the developer, trust in the system, and trust in the other players. Cheats are a negative sum game, where a minority benefits less than the majority is harmed. There are a bunch of different ways to attack a trust-based system including writing a bunch of code (hacks), or through social engineering (for example convincing people that the system isn’t as trustworthy as they thought it was). For a game like Counter-Strike, there will be thousands of cheats created, several hundred of which will be actively in use at any given time. There will be around ten to twenty groups trying to make money selling cheats. We don’t usually talk about VAC (our counter-hacking hacks), because it creates more opportunities for cheaters to attack the system (through writing code or social engineering). This time is going to be an exception. There are a number of kernel-level paid cheats that relate to this Reddit thread[1] . Cheat developers have a problem in getting cheaters to actually pay them for all the obvious reasons, so they start creating DRM and anti-cheat code for their cheats. These cheats phone home to a DRM server that confirms that a cheater has actually paid to use the cheat. VAC checked for the presence of these cheats. If they were detected VAC then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache. If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check. 570 cheaters are being banned as a result. Cheat versus trust is an ongoing cat-and-mouse game. New cheats are created all the time, detected, banned, and tweaked. This specific VAC test for this specific round of cheats was effective for 13 days, which is fairly typical. It is now no longer active as the cheat providers have worked around it by manipulating the DNS cache of their customers’ client machines. Kernel-level cheats are expensive to create, and they are expensive to detect. Our goal is to make them more expensive for cheaters and cheat creators than the economic benefits they can reasonably expect to gain. There is also a social engineering side to cheating, which is to attack people’s trust in the system. If “Valve is evil – look they are tracking all of the websites you visit” is an idea that gets traction, then that is to the benefit of cheaters and cheat creators. VAC is inherently a scary looking piece of software, because it is trying to be obscure, it is going after code that is trying to attack it, and it is sneaky. For most cheat developers, social engineering might be a cheaper way to attack the system than continuing the code arms race, which means that there will be more Reddit posts trying to cast VAC in a sinister light. Our response is to make it clear what we were actually doing and why with enough transparency that people can make their own judgements as to whether or not we are trustworthy. Q&A 1) Do we send your browsing history to Valve? No. 2) Do we care what porn sites you visit? Oh, dear god, no. My brain just melted. 3) Is Valve using its market success to go evil? I don’t think so, but you have to make the call if we are trustworthy. We try really hard to earn and keep your trust.” – Gabe Newell, http://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/

To ride in the Tour de France, as well with most other professional sports, the riders must submit to a drug test in order to compete. Why should the competitive gaming scene be held to a lesser standard? There are non-VAC secured servers for people to “experiment” with cheats. In competitive and professional leagues, no one wants plays against someone with an unfair advantage.

I’ve been playing online games since before there was a world wide web, but I have to say that the idea that cheaters are the “lifeblood” of online gaming is a new one to me. The reality is that I know plenty of people who are driven away from online gaming – especially PC gaming – by the presence of cheaters.

Most people play games casually, and they certainly don’t see games as “a negotiation about the rules themselves.” They see the rules as the framework by which they learn how to play and get better. Cheaters frustrate that. They frustrate gamers, and they drive people out of playing.

The only people who like cheating are cheaters – people that you have rightly said are a tiny fraction of total gamers. The gaming community as a whole (as evidenced by the comments here as well as just real life experience) doesn’t like cheaters or cheating.

Maybe VAC is too intrusive on privacy, but that’s another issue. The question for the vast majority of gamers is how to balance privacy and preserving the rules, not “how can we cheat better?”

In your article, you claim that cheaters “approach play from a different but no less valid position.” You may want to go refresh your memory on the definition of the word “valid.” In fact, all definitions of the word, in various contexts, seem contradictory to your argument, an argument which also seems to be based solely on your opinion, and has no support or basis in logic whatsoever. I’m not sure how anyone could possibly claim that cheating, in ANY context, is a valid position for ANYTHING. I can’t think of a single situation where cheating is considered acceptable, legally, socially, politically, academically, or otherwise. The simple fact is that cheating, in a multiplayer game, makes the game less fun for everyone who is not cheating. Therefore, cheating should not be allowed in multiplayer games. Period. And it certainly is not a “valid position.” Valve’s attempt to enforce this may bring us into a grey area. Invasion of privacy is certainly an issue… But let’s be serious. Valve’s not the only company doing it, and their motives seem to be simply to protect the fun and competitive spirit of their online games. Having read more of your lengthy, wordy articles, I realize now that you often take the most unpopular stance, simply for the sake of stirring up controversy. It’s quite impressive how many words you can use to say nothing useful at all.

This article is a great example of the inane drivel that is permeating the press, both online and in the traditional paper form. The author has little to no real understanding of gaming culture, nor sensible business models and apparently likes to compare viewers of pornography, to people who like to break the rules in online gaming.

Here is a better comparison, dear author. Cheaters in games, people who purposely attempt to bypass the rules to provide themselves with an unfair advantage, are no different to those individuals who partake in performance enhancing drugs prior to professional competitions.

Both arenas have set rules that participants agree to abide by, either by an unwritten code of conduct or by the signing of an End User License Agreement. In either case, breaking those rules is seen as contrary to the spirit (or in competitions with prize money actual law) of the thing.

I hope I made that clear enough for you, dear author, and that in future you will either think before writing, or just not write at all. Preferably the latter.

Good Lord, are you really that vapid? I hear you complain about Valve’s VAC system, but there is not a whisper of Blizzard’s Warden system, which is at least just as intrusive, if not more. Or Respawn’s anti-cheat enforcement in Titanfall, which take everyone you seem to be defending and throws them into their own personal cesspit. It should speak volumes to you that a fairly respected outfit (at least, many of the employees) considers consolidating the ‘lifeblood of gaming’ into a single group to be a punishment for those individuals.

Creating new content that is publicly available, which does not circumvent or negate the underlying system is ok. That’s modding, and it gives up great things like housing mods in Skyrim, creative and ingenious weapons and hats in Team Fortress 2, and opens up the realm of exploration for those that have the knowledge and drive to do so. Cheating, on the other hand, with things like aimbots, spawn restrictors, and insta-gib functions, does nothing for the game or the community as a whole, and only serves to inflate the ego of an individual, or provide an advantage that lies well beyond the initial constraints of the game to such a point as to make the system itself meaningless.

As en example, a modder would be, in the investment world, a remarkable fund manager that devises a new means of stock analysis that provides him with a leg up on price point movements. A cheater, on the other hand, is somebody that is constantly guilty of insider trading.

I expect I used some terms up there that you don’t understand. I say this because I cannot help but be forced to call your knowledge and credentials regarding games, gaming, and game culture into stark question. Your fundamental arguments leads me to believe one of three assumptions about you: 1) You have never played against somebody that has used what can legitimately be called a cheat system. 2) You are one of the cheaters, and are morally ambivalent enough to think that you have come up with a valid justification for your unethical behavior. 3) You know nothing about games, and are a hack writer that thinks he knows things about a culture, and instead has shown himself to be an outsider to said culture. I’m inclined to think you’re option three. You’re like a guy who has a doctorate in animal husbandry, who thinks he knows more than a whole community of people who have been raising and caring for animals their whole lives.

Consequently, I feel that I cannot take you seriously, and will not be able to do so until such a point as your qualifications are validated, which I highly doubt will happen.

Cheaters have absolutely zero positive effect on games, players, or game design. The fact that this publisher tries to use the argument “Cheaters are the lifeblood of game culture…” further cements my belief that VAC is not only one of the best anti-cheat systems out there, it is doing its job rather efficiently.

Furthermore (I really wish I could edit my original comment), I encourage readers to re-read this article as if the publisher was just banned by VAC from his favorite game for a perfectly legitimate cheating violation. It makes a great deal more sense and spin rather evaporates.

I don’t understand how people like you are allowed to write. Even if this is simply your opinion, it is factually wrong. Every legit gamer and even some cheaters are going to disagree with your statements.

In most every sport there is a referee to make judgment calls on invalid forms of play. Valve is simply creating a more efficient Referee. Also, I would guess that those people that were banned failed to comply to the TOS (Terms of Service).

If a baseball player charged the pitchers mound with bat in hand and clubbed the pitcher to unconsciousness. To this author, this is no less valid than someone playing with in the rules of the game. Neither the player using a “hack” nor the baseball player hitting the pitcher with a bat should be punished. It’s all Valid.

Hey, so I just wanted to say that I don’t think cheating is at all admirable in this context. You have said that there are many ways to deal with cheaters, by ganging up on them, worshiping them, harassing them, etc. You even say that the way they ‘change the rules’ can be helpful to the industry by allowing gamers to think about the game in creative ways. However, when I think of cheating, I imagine someone forcing their own set of rules onto others to gain an unfair advantage for themselves. Is this in any way more admirable than the way the game ‘forces’ rules onto the majority? No. The game’s rules ensure that all individuals begin from the same point and are able to ‘prove’ themselves to the community by what they perceive as hard-work. All people are given the same chance, equal opportunity to be as great as anyone else. Cheaters, on the other hand, will take steps to ensure that they can easily do whatever they want without limit. Often, this power is used in selfish ways to gain ‘invincibility’ or another advantage that other people don’t have access to. This leads to frustration and anger for the strangers who have been promised an equal opportunity. The end result is that only the cheater is satisfied, leaving the rest unhappy, detracting from the point of games: entertainment. If the cheater really wanted to improve the experience, he would perhaps give a warning to the other gamers, asking them if they would be up for “a little bit of fun.” He would respect their wishes, and if there was any disagreement, he would ask for willing gamers to join a custom, private match where everyone knew what they were in for. That way, he would facilitate a new set of rules without forcing his will onto others. This is why I don’t believe cheaters deserve any respect for what they do. Anti-cheating software like VAC is part of the rules; in other words, it is the rule that says, “If any of the rules provided by the game are broken by an individual, he/she will be banned from the game.” Anyone who does not like that rule has two choices. They can refuse to play the game, avoiding the rule completely. Otherwise, they can ask everyone if the rule can be changed. Simply saying that “VAC is bad, an invasion of privacy,” does not at all help anything at all.